Steve Kemp discovered a vulnerability in xatitv, one of the
programs in the gatos package, which is used to display video with
certain ATI video cards.

xatitv is installed setuid root in order to gain direct access
to the video hardware. It normally drops root privileges after
successfully initializing itself. However, if initialization fails
due to a missing configuration file, root privileges are not
dropped, and xatitv executes the system(3) function to launch its
configuration program without sanitizing user-supplied environment
variables.

By exploiting this vulnerability, a local user could gain root
privileges if the configuration file does not exist. However, a
default configuration file is supplied with the package, and so
this vulnerability is not exploitable unless this file is removed
by the administrator.

For the current stable distribution (woody) this problem has
been fixed in version 0.0.5-6woody1.

For the unstable distribution (sid), this problem will be fixed
soon.

We recommend that you update your gatos package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

jaguar@felinemenace.org
discovered a vulnerability in jftpgw, an FTP proxy program, whereby
a remote user could potentially cause arbitrary code to be executed
with the privileges of the jftpgw server process. By default, the
server runs as user "nobody".

Several buffer overflow vulnerabilities were discovered in
ethereal, a network traffic analyzer. These vulnerabilites are
described in the ethereal advisory "enpa-sa-00013". Of these, only
some parts of CAN-2004-0176 affect the version of ethereal in
Debian woody. CAN-2004-0367 and CAN-2004-0365 are not applicable to
this version.

For the current stable distribution (woody), these problems have
been fixed in version 0.9.4-1woody7.

For the unstable distribution (sid), these problems have been
fixed in version 0.10.3-1.

We recommend that you update your ethereal package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.